<html>
<head><meta charset="utf-8"><title>criteria for categories · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html">criteria for categories</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="217071724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217071724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217071724">(Nov 17 2020 at 22:22)</a>:</h4>
<p>I'm drafting a security advisory for the time crate, as it can segfault in very specific situations. What category would this fall under? I am unable to find a description of what category should be used when.</p>



<a name="217094701"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217094701" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217094701">(Nov 18 2020 at 04:15)</a>:</h4>
<p><code>code-execution</code>, <code>memory-corruption</code>, and/or <code>memory-exposure</code> depending on the situation</p>



<a name="217094744"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217094744" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217094744">(Nov 18 2020 at 04:16)</a>:</h4>
<p>(also we've talked about adopting CWE at various points, if someone wants to actually do the work)</p>



<a name="217094748"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217094748" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217094748">(Nov 18 2020 at 04:16)</a>:</h4>
<p>I did CVSS and I volunteer not to <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<a name="217096445"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217096445" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217096445">(Nov 18 2020 at 04:53)</a>:</h4>
<p><span class="user-mention" data-user-id="245610">@Jacob Pratt</span> is it a segfault from null (or some other address from the 0 page) or from some random pointer</p>



<a name="217096449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217096449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217096449">(Nov 18 2020 at 04:53)</a>:</h4>
<p>if the former it's probably none of those.</p>



<a name="217098760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217098760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217098760">(Nov 18 2020 at 05:47)</a>:</h4>
<p>Segfault from what is random at the time of dereferencing. It's _was_ valid, but the OS moves things around apparently. Definitely not a null pointer.</p>



<a name="217098825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217098825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217098825">(Nov 18 2020 at 05:48)</a>:</h4>
<p>Currently just waiting on a CVE before creating a PR, though.</p>



<a name="217098928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217098928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217098928">(Nov 18 2020 at 05:50)</a>:</h4>
<p>oof yeah. sounds bad.</p>



<a name="217099557"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217099557" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217099557">(Nov 18 2020 at 06:05)</a>:</h4>
<p>Thankfully it's my best guess that running into this is quite rare. It requires setting environment variables for the running program at the _exact_ same time as reading it in a method call. Even running both without delay on separate threads, it'll take ~100 iterations on my machine from the proof of concept.</p>



<a name="217099604"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217099604" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217099604">(Nov 18 2020 at 06:06)</a>:</h4>
<p>Apparently stdlib locks the environment while reading, but I don't have that advantage with FFI.</p>



<a name="217099951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217099951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217099951">(Nov 18 2020 at 06:15)</a>:</h4>
<p>Can you only trigger this from the FFI?</p>



<a name="217100037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217100037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217100037">(Nov 18 2020 at 06:17)</a>:</h4>
<p>I believe so. It was an issue discovered in the time and chrono crates specifically, as they use the same OS API</p>



<a name="217211181"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217211181" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217211181">(Nov 18 2020 at 23:32)</a>:</h4>
<p>I've just created a PR with this vulnerability. An advisory on GitHub <a href="https://github.com/time-rs/time/security/advisories/GHSA-wcg3-cvx6-7396">is published</a>. It has been assigned CVE-2020-26235.</p>



<a name="217216842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217216842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217216842">(Nov 19 2020 at 00:46)</a>:</h4>
<p>If libstd is content to mostly ignore the issue, triggering it requires unsafe code (invoking C code that performs setenv), and there's no real possible fix, it's unclear to me what priority this actually requires tbh</p>



<a name="217218255"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217218255" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217218255">(Nov 19 2020 at 01:06)</a>:</h4>
<p>It's actually invoking getenv, but the point is the same. Ideally I'd have some way to lock the environment, which is apparently what stdlib does now. Having a lock would let me manually take control before performing getenv.</p>



<a name="217218292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/criteria%20for%20categories/near/217218292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Pratt <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/criteria.20for.20categories.html#217218292">(Nov 19 2020 at 01:07)</a>:</h4>
<p>Short of that or a thread-safe getenv (in libc), I don't see any way to avoid this bug.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>